The Long Arm of UK Law Enforcement Reaches a Handshake Deal with U.S. DOJ on UK-U.S. Electronic Data

The UK Home Office and the U.S. Department Of Justice (“DOJ”) have signed an agreement (the “Agreement”) which will enable British and U.S. law enforcement agencies to compel UK and U.S. cloud service providers (“CSPs”) to disclose electronic data in criminal investigations. The Agreement follows the passage of the U.S. Clarifying Lawful Overseas Use of Data Act (“CLOUD Act”) in 2018¹ and the UK Crime (Overseas Production Orders) Act in 2019 (“COPO Act”)² , and could dramatically expedite investigations into serious cross-border crime such as fraud and corruption, terrorism and child sexual exploitation. CSPs – and their clients – on both sides of the pond should be preparing now to respond to the increased volume and scope of future disclosure orders as a result of the Agreement.

The announcement is not unexpected. The Agreement is yet a further step on the path that U.S. and UK authorities are treading, side by side, towards more cooperative and collaborative cross-border investigations. Dechert predicted in March that any designated international co-operation agreement (“DICA”)3 between the U.S. and the UK would likely grant reciprocal rights to the U.S. to compel UK companies to provide data to U.S. authorities, and the Agreement does exactly that.

The UK Home Secretary, Priti Patel, and the U.S. Attorney General, William Barr signed the Agreement on 3 October 2019, following protracted negotiations which have been ongoing since 20154. The Home Office hopes that the Agreement will expedite the process of obtaining electronic evidence from the U.S.5 by reducing the time that process takes from months, sometimes years, to weeks or even days.6 The potential burden on U.S. and UK CSPs should not be underestimated. CSPs could be ordered to provide terabytes of data within tight timeframes, whilst navigating complex legal issues such as privilege, privacy, and data protection during the process.

The Agreement itself has not yet been released, pending notification to U.S. Congress and UK Parliament7. Although some concerns have been raised regarding human rights (specifically the use of UK data in U.S. criminal trials involving the death penalty)8, the repeated commitment by the Home Office and the DOJ to tackling serious cross-border crime makes it likely that the Agreement will be passed through the respective legislative approval processes reasonably quickly.

Although there is no immediate impact – the operative provisions under the COPO Act which would allow UK authorities to obtain disclosure orders against U.S. CSPs are not yet in force – this announcement brings the prospect of U.S. and UK CSPs being compelled to provide data to foreign authorities one step closer. CSPs would be well advised to start preparing for that prospect now, as there is a good chance the authorities will be quick out of the blocks in deploying their new powers. Dechert has extensive experience in the U.S. and the UK representing clients complying with, defending or (where appropriate) challenging such orders. With specialists on both sides of the Atlantic, Dechert can provide streamlined, multi-jurisdictional advice on how to respond to orders in the U.S., the UK, or both.

Once a copy of the Agreement is released, CSPs in other countries would also be well advised to review it. Dechert predicts that this could be the first of many bi-lateral evidence gathering agreements that CSPs will have to contend with in the future. The UK government has already stated that it would seek to use the Agreement as a template for similar evidence gathering agreements with other countries in the future.9 With the pace of UK / U.S. cross-border cooperation gathering speed, other countries should not be surprised if the UK and the U.S. authorities soon come knocking on their doors.

Footnotes

_{1) Dechert’s previous analysis of the CLOUD Act can be found here and here.
2) Dechert’s previous analysis of the COPO Act can be found here.
3) See Dechert’s OnPoint, The Long Arm of The Law Gets Longer – UK Introduces Overseas Production Orders, for further details on DICAs under the COPO Act.
4) House of Lords Library Briefing: Crime (Overseas Production Orders) Bill [HL], 5 July 2018, p. 5.
5) Under the current mutual legal assistance process, a domestic UK authority has to submit a written request for assistance to its U.S. counterpart. The U.S. counterpart determines whether or not to cooperate with the request, and then has to engage in the relevant domestic processes for obtaining evidence. If successful, the U.S. then provides any material obtained to the UK for use in its investigation.
6) Home Office News story, UK and US sign landmark Data Access Agreement, 4 October 2019.7) DOJ Justice News, U.S. and UK Sign Landmark Cross-Border Data Access Agreement to Combat Criminals and Terrorists Online, 3 October 2019.}